import type { ShortlinksCredentialChainOptions } from "../client-types.js";
import { ShortlinksApiClient } from "./generated.js";
type SdkEnv = Record<string, string | undefined>;
/** The resolved SDK transport: authority, credential, and WHERE each came from. */
export interface ShortlinksSdkTransport {
    /** The SDK transport is HTTP-only: every resolved transport talks HTTP to the `/v1` API. */
    mode: "http";
    /**
     * Origin WITHOUT the `/v1` suffix, so a caller that composes `/v1/...` gets
     * exactly one version segment.
     */
    baseUrl: string;
    /** The credential the transport will send, or null when the caller pinned an authority without one. */
    apiKey: string | null;
    /** WHERE the credential came from — an env key NAME, a Keychain reference, a path. Never a value. */
    apiKeySource: string | null;
    /** WHERE the authority came from, or `"default"` for the fleet gateway. */
    apiUrlSource: string | null;
}
export interface ResolveShortlinksSdkTransportOptions {
    /** Tier 1: an explicit authority. Used verbatim, minus a trailing slash. Pins the credential (never the ambient key). */
    baseUrl?: string | undefined;
    /** Tier 1: an explicit credential. */
    apiKey?: string | undefined;
    /** Tier-1 profile selection and the injectable `security` runner tests use. */
    credentials?: ShortlinksCredentialChainOptions;
    /** Defaults to `process.env`. */
    env?: SdkEnv;
    /** Custom fetch (defaults to global fetch). */
    fetch?: typeof fetch;
    /** Extra headers merged into every request. */
    headers?: Record<string, string>;
}
/**
 * Resolve the SDK's authority and credential, fresh, through the one
 * @hasna/contracts client chain. An explicit `baseUrl` pins the credential
 * (tier 1 only — the ambient fleet key is never attached to a caller-chosen
 * authority, #1794); otherwise the chain decides, and a missing credential
 * throws — the SDK client is HTTP-only and never degrades.
 */
export declare function resolveShortlinksSdkTransport(options?: ResolveShortlinksSdkTransportOptions): ShortlinksSdkTransport;
/**
 * Build the hosted `/v1` client with the fleet resolver behind it — the
 * generated {@link ShortlinksApiClient} takes an explicit `baseUrl` and has no
 * environment surface of its own, which left every caller writing a private
 * copy of the chain.
 *
 * The credential is refreshed PER REQUEST, not per client: the generated
 * client stores whatever key it is handed, so a client built once and held for
 * hours would keep sending the key that happened to resolve at startup — the
 * staleness the fresh-per-call chain exists to remove. A re-resolution that
 * throws or comes back empty leaves the constructed key in place, so a
 * transient unreadable Keychain cannot turn a working client into a failing
 * one mid-flight.
 *
 * Throws when no credential resolves: this client speaks only to the hosted
 * authority, so there is no local fallback.
 */
export declare function createShortlinksApiClient(options?: ResolveShortlinksSdkTransportOptions): ShortlinksApiClient;
export {};